net: support marking accepting TCP sockets

When using mark-based routing, sockets returned from accept()
may need to be marked differently depending on the incoming
connection request.

This is the case, for example, if different socket marks identify
different networks: a listening socket may want to accept
connections from all networks, but each connection should be
marked with the network that the request came in on, so that
subsequent packets are sent on the correct network.

This patch adds a sysctl to mark TCP sockets based on the fwmark
of the incoming SYN packet. If enabled, and an unmarked socket
receives a SYN, then the SYN packet's fwmark is written to the
connection's inet_request_sock, and later written back to the
accepted socket when the connection is established.  If the
socket already has a nonzero mark, then the behaviour is the same
as it is today, i.e., the listening socket's fwmark is used.

Black-box tested using user-mode linux:

- IPv4/IPv6 SYN+ACK, FIN, etc. packets are routed based on the
  mark of the incoming SYN packet.
- The socket returned by accept() is marked with the mark of the
  incoming SYN packet.
- Tested with syncookies=1 and syncookies=2.

[android-3.4 commit 4593f09b1f9939ec6ed2f8d7848def26b98c47ac]

Change-Id: I1c7904543d15cca7acce12a82a497f1f5f1c5597
Signed-off-by: Lorenzo Colitti <lorenzo@google.com>
cgroup: Take css_set_lock from cgroup_css_sets_empty()

As indicated in the comment above cgroup_css_sets_empty it needs the
css_set_lock. But neither of the 2 call points have it, so rather then fixing
the callers just take the lock inside cgroup_css_sets_empty().

Change-Id: Ib6bc053d7761f0f20b5408c99b82015e1c8b06c8
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
cgroup: Fix use after free of cgrp (cgrp->css_sets)

Running a 3.4 kernel + Fedora-18 (systemd) userland on my Allwinner A10
(arm cortex a8), I'm seeing repeated, reproducable list_del list corruption
errors when build with CONFIG_DEBUG_LIST, and the backtrace always shows
free_css_set_work as the function making the problematic list_del call.

I've tracked this doen to a use after free of the cgrp struct, specifically
of the cgrp->css_sets list_head, which gets cleared by free_css_set_work.

Since free_css_set_work runs form a workqueue, it is possible for it to not be
done with clearing the list when the cgrp gets free-ed. To avoid this the code
adding the links increases cgrp->count, and the freeing code running from the
workqueue decreases cgrp->count *after* doing list_del, and then if the count
goes to 0 calls cgroup_wakeup_rmdir_waiter().

However cgroup_rmdir() is missing a check for cgrp->count != 0, causing it
to still continue with the rmdir (which leads to the free-ing of the cgrp),
before free_css_set_work is done. Sometimes the free-ed memory is re-used
before free_css_set_work gets around to unlinking link->cgrp_link_list,
triggering the list_del list corruption messages.

This patch fixes this by properly checking for cgrp->count != 0 and waiting
for the cgroup_rmdir_waitq in that case.

Change-Id: Ie633220394b8ecddd0828f4a2b8cd680162d8df4
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
net: core: Support UID-based routing.

[android-3.4 commit 0b428749ce5969bc06c73855e360141b4e7126e8]

This contains the following commits:

1. 0149763 net: core: Add a UID range to fib rules.
2. 1650474 net: core: Use the socket UID in routing lookups.
3. 0b16771 net: ipv4: Add the UID to the route cache.
4. ee058f1 net: core: Add a RTA_UID attribute to routes.
    This is so that userspace can do per-UID route lookups.

Bug: 15413527
Bug: 16175826
Change-Id: I28aefb5f7e2fb4254974c79ffeafc1365220db08
Signed-off-by: Lorenzo Colitti <lorenzo@google.com>
Handle 'sk' being NULL in UID-based routing.

[android-3.4 commit 0836a0c191f580ed69254e0b287cdce58481e978]

Bug: 15413527
Bug: 16175826
Change-Id: Ie6bb0f1c788fea5ae61a728d028be2c2c3167d94
Signed-off-by: Sreeram Ramachandran <sreeram@google.com>
Signed-off-by: Lorenzo Colitti <lorenzo@google.com>